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Abstract 

We consider several models of 1-round classical and quantum com- 
munication, some of these models have not been defined before. We 
"almost separate" the models of simultaneous quantum message pass- 
ing with shared entanglement and the model of simultaneous quantum 
message passing with shared randomness. We define a relation which 
can be efficiently exactly solved in the first model but cannot be solved 
efficiently, either exactly or in 0-error setup in the second model. In 
fact, our relation is exactly solvable even in a more restricted model 
of simultaneous classical message passing with shared entanglement. 

As our second contribution we strengthen a result by Yao which 
says that a "very short" protocol from the model of simultaneous clas- 
sical message passing with shared randomness can be simulated in the 
model of simultaneous quantum message passing: for a boolean func- 
tion /, G exp(0(i?jl(/))) • logn. We show a similar result for 
protocols from a (stronger) model of 1-way classical message passing 
with shared randomness: G exp(0(i?p(/))) • logn. We demon- 
strate a problem whose efficient solution in follows from our result 
but not from Yao's. 

1 Introduction 

In this work we consider several models of l-round communication, both 
classical and quantum (see Section |21 for definitions). To the best of our 
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knowledge, some of these models have never been studied before, nor were 
they defined. For example, we consider the situations when quantum com- 
munication channels are used but the players share a classical random string 
(and no entanglement), as well as the case when the players share entangle- 
ment but communication channels are classical. 

We argue that these "unusual" models are interesting to look at. There 
are several open questions related to these models which can be viewed as 
natural analogues of yet unsolved questions related to the usual models. 
Besides, models like entangled parties with classical communication channels 
might correspond to some "realistic" circumstances, when physical constrains 
make it hard to establish quantum communication. We also note that the 
setup of entangled players sending simultaneous classical messages is closely 
related to the matters considered by Cleve et al. in |CHTW04] . 

Our main interest in this paper is the power of shared entanglement in 
communication; in particular, we are looking for similarities and differences 
between entanglement and the (intuitively similar) resource of shared ran- 
domness in the context of 1-round communication models. To the best of 
our knowledge, prior to this work there was no explicit construction showing 
that entanglement can be more powerful than shared randomness in the same 
model of communication (for that one has to deal with at least one model 
which is unusual in the above sense). 



1.1 Our Results 

In this work we "almost separate" the models of simultaneous quantum mes- 
sage passing with shared entanglement and the model of simultaneous quan- 
tum message passing with shared randomness. We define a relation Mi/M„ 
which can be solved exactly in the first model^ but cannot be solved either 
exactly or in 0- error setup in the second model (where "solved" means effi- 
cient solution of cost poly(logn)). We conjecture that our relation is hard 
for the latter model even in the bounded error case. 

Besides, we extend a result by Yao who has shown that a "very short" pro- 
tocol from the model of simultaneous classical message passing with shared 
randomness can be simulated in the model of simultaneous quantum mes- 
sage passing (with no shared resource): for a boolean function /, (?"(/) G 

o( f f)] 

2 V '' J -logn. We show a similar result for protocols from a (stronger) model 
^Actually, we show that MHMn is solvable in a more restricted model i?!!. 
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of l-way classical message passing with shared randomness: for a boolean 
function /, G -logn. We demonstrate a communication prob- 

lem whose efficient solution in C^" follows from our simulation technique but 
not from Yao's. 

As a straightforward corollary, we show that a protocol of constant cost 
in the model of l-way quantum message passing with shared randomness 
can be efficiently simulated in the model of simultaneous quantum message 
passing. 

2 Notation 

In this paper we will consider several models of single round communication 
between two parties {Alice and Bob). In general, a communication task can 
be vied as follows: Alice receives an input string x, Bob receives an input 
string y, then some communication occurs which allows to compute output, 
based on x and y. The goal is to produce "good" output using minimum 
amount of communication (measured in either bits or qubits). Communica- 
tion task defines which outputs are good for every possible input, this task 
can be given in terms of either a function or a relation (the latter allows 
several good outputs for each input). 

A communication model defines what sort of communication can be per- 
formed in order to solve the problem. We will consider two types of models. 
In simultaneous message passing models Alice and Bob send one message 
each to the third party (a referee), who has to produce an output based on 
the received messages (the model is called simultaneous since Alice and Bob 
do not receive any information from each other and therefore they can pro- 
duce their messages simultaneously, or more precisely, asynchronously). In 
l-way communication models Alice sends a message to Bob and he has to 
produce an output based on that message and his part of the input. 

Sometimes an additional resource is given to Alice and Bob in order to 
reduce the communication cost, that can be either a string of shared random 
bits or shared pairs of entangled qubits (w.l.g., EPR pairs). In either case, 
the amount of the shared resource is not limited by the model. 

We will be interested in the following models of communication: 

Definition 1. Let 

, Rp, Rl, r\, Q\ Qp, Ql, Q", QI, QI 
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be 1-round communication models defined as follows: 

• R corresponds to communication using classical channels and Q cor- 
responds to communication through quantum channels; 

• the superscript \\ corresponds to simultaneous message passing and 1 
corresponds to 1-way communication; 

• the subscript p means that a "public" random string is shared between 
two communicating parties (two broadcasting parties in case of simul- 
taneous message passing), and the subscript e means that EPR pairs 
are shared between the parties. 

We will consider communication complexity of both functions and re- 
lations. We require that a protocol produces right answer with constant 
advantage over trivial (where "trivial" usually means achievable by a ran- 
dom guess, e.g., nontrivial accuracy is any constant greater than 1/2 in the 
case of binary functions, while any constant greater than is nontrivial in 
the case of 0-error protocols). 

Given a communication task P (either a function or a relation), we will 
write (P), etc. to address the number of (qu)bits transferred by the "cheap- 
est" protocol solving P in the corresponding model. We will write P ^ 
when R^ (P) G poly(logn), and similarly for the rest of defined models. 

We will use sign C to denote proper sets inclusion and by C we will denote 
the regular inclusion. 

3 Classical Randomness in Communication 

Quantum communication protocol with (classical) random coins (in both 

and Qp) can be naturally viewed as a "classical mixture" of quantum proto- 
cols, where the random string is replaced with a predefined binary sequence.^ 
That is why several classical (in both senses) results readily extend to the 
models and qI . Let us mention two of them, which we will need later. 

^In the case of Qp there exists one obstacle: the referee does not know the random 
string shared between two broadcasting parties. However we will see that O(logn) bits 
of shared randomness are sufficient, so the referee can receive their values from one of the 
parties, at the price of additional O (logn) communicated qubits. 
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Fact 2. ( IN 91^ ) Communication protocols in the models with shared ran- 
domness can w.l.g. be assumed to be using O(logn) bits of shared random- 
ness. 

In particular, it follows that = , because Alice can send to Bob 
O (logn) random bits she used, thus making them "public". 

By distributional deterministic communication complexity of a problem 
with respect to input distribution D we mean the minimum cost of a deter- 
ministic protocol solving the problem with constant advantage over trivial 
success probability, when the input is distributed according to D. 

Fact 3. ( ^Y83\l ) Communication cost of a problem in the models with shared 
randomness is lower bounded by the distributional deterministic complexity of 
the same problem in the same model, with respect to any input distribution. 

Actually, Fact El is one direction (the "easy" one) of the Minimax Theo- 
rem. 

4 1-Way Communication 

In this section we give two simple equivalence results for the 1-way commu- 
nication models we defined. 

The first equivalence follows from Fact E) 

Proposition 4. Qp=Q^. 

Similarly to the case of classical communication channels, Alice can send 
to Bob O (log n) random bits, thus making them "public" . 

The second equivalence is a consequence of the quantum teleportation 
phenomena: 

Proposition 5. R^ =Qi ■ 

Using shared EPR pairs, Alice can teleport to Bob through the classical 
channel her quantum message. 
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5 Simultaneous Message Passing 



Usually the setting of simultaneous message passing is more interesting (and 
sometimes harder to analyze) than 1-way communication. For example, in 
the classical theory of communication complexity the model of simultaneous 
messages is the only one which can be noticeably strengthened by adding to 
it shared randomness. 

5.1 A Generalization of Yao's Simulation 

In |Y03j Yao shows that a protocol of constant complexity in can be 
simulated by a protocol of complexity O (logn) in Q"^: 

Fact 6. ( IY03\I ) Let f be a boolean function. Then 

(^ll(/)e2°K(^)) -logn. 



Let us generalize his result. We do that in two steps. 
Proposition 7. For any boolean function f , 

(^ll(/)e2«K(^))-logn. 



Remark 1: Note that in the context of Proposition [7| the communication 
models and R^ are not equivalent, since additive factor logn becomes 
significant (cf. with Fact 12)). 

Proof of Proposition Let s be the communication cost of a protocol for 
f{x, y) in Rp which uses r G O (logra) public random bits and is correct with 
at least constant probability higher than 1/2. Let a{x,q) be the message 
sent by Alice in this protocol when her input is x and the random string is 
q. Let b{y, a, q) be a boolean predicate ({0, l}-valued) getting value 1 if Bob 
accepts given input y, random string q and the message from Alice being a. 

To "simulate" the original protocol in do the following (for G N and 
< r < 1 to be chosen later): 
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• Alice sends k copies of 

|a)"='2-i-^|g) |a(x,g))|l). 

• Bob sends k copies of 

\(3)'='2-'^-J2\Q)W)\b{y,a,q)). 

q,a 

• Using the swap test, the referee estimates the value of and ac- 
cepts if the approximation is at least r. 

Observe that 

{a\(3) = 2-('-+i) 5^(g|g> {a{x,q)\a) (l|%,a,g)> 

q,a 

= 2-f E[/(g)], 

q 

where /(g) is an indicator of the event given the random string q, Alice sends 
a message which causes Bob to accept. In other words, I{q) gets value 1 if 
and only if the content q of the shared random string would cause the original 
protocol to accept. 

Therefore, if we set r = 2^*^'^/^+^^ and k E 2*^*^*^ high enough, with high 
confidence the new protocol would accept [x, y) if and only if the original one 
would do so with probability greater than 1/2. The cost of the new protocol 
is 2'^^^^ ■ logn, as required. Mproposition\^ 

Proposition 8. For any function f , 



Proof sketch of Proposition^^ Assume w.l.g. that the messages from Alice 
are pure states (this can be achieved by at most doubling the number of 
communicated qubits). Since we only require constant precision, we can 
replace the quantum message from Alice by a classical one of exponential 

length. ^Proposition\^ 

Based on Propositions [7| and |H1 we get the following corollary: 

Corollary 9. A function f of constant communication complexity in can 
be solved in (5" using O (logra) qubits of communication. 
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5.1.1 Strength of Our Improvement 

We think that Proposition |H1 and Corollary El are not very interesting from 
the technical point of view. In particular, Corollary IHl might be established 
without Proposition [71 based on the (trivial) statement that for any boolean 

f, G 2^(^^(^)) and on the original Fact El 

On the other hand, Proposition [71 is less trivial. Note that if we would 
try to establish a similar result through application of Fact El and simulat- 
ing an i?p -protocol in the price we would pay for such simplification 
would be exponential loss in tightness (we would end up with something like 
gll(/)eexp (expO(i?i(/)))-logn). 

To establish the "usefulness" of Proposition [71 let us define a function / 
such that 

i?^(/) GO (log(logn)) 

but 

4(/)Gfi(logn). 

In other words, membership of / in would follow from Proposition [71 but 
not from Yao's original Fact El 

We first define an "auxiliary" predicate. 

Definition 10. Let x G {0, Qj^d y = (yi, . . , 2/(iog m)/2 ) ? where all yi-s 

are distinct binary strings of length log log m. Then subin(a;, y) = I if and 
only if X is identical to one of yi-s. 

Definition 11. Let a = [ai, ...,am) and b = (bi, ...,bm), where each pair 
{ai, bi) forms a correct input to subm- Then f{a, b) = 1 if \ {i \ subni(aj, bi)}\ > 
m/2 and f{a, b) =0 |{i | subm(at, &«) }| = 0, with a promise that one of the 
two cases holds. 

As usual, we use n to denote the length of input to /. 

To see that (/) G O (log(logn)) , consider a protocol where several ran- 
dom indices in the range {1, .., m} are tossed as a public coin, then Alice sends 
ttj-s corresponding to those random indices and Bob accepts if and only if for 
at least one of the indices subni(aj, bi) is satisfied. 

To show that Rl{f) G Cl (log n) we use an approach suggested by Fact El 
we will fix the input distribution and restrict our attention to deterministic 
protocols. Denote by X the set of (a, b)-s which form correct input to / and 
in every a = (ai, a^) all a^-s are identical and in every b = {bi, bm) all 
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bi-s are identical. Then according to our distribution, the input is with prob- 
abihty 1/2 a uniformly chosen positive instance from X and with probability 
1/2 a uniformly chosen negative instance from X. 

Under this distribution the actual task of a protocol solving / would be 
to solve an instance of subm(ao5 ^o) when Alice receives ao and Bob receives 
bo- Our input distribution for subm(ao, &o) corresponds to uniformly choos- 
ing a positive instance with probability 1/2 and a negative instance with 
probability 1/2. 

Let us see that this task requires Q (log n) communication in the model 
of i?", when the protocol is deterministic (and the error is bounded by a 
constant smaller than 1/2). W.l.g., let Alice always send to the referee. 
Then it is "easy to see" that Bob has to send Q (log n) bits, since his part 
of input is a random subset of {1, ..,m} of size m/2 and his message to the 
referee should enable the recipient to decide with constant accuracy whether 
a random oq belongs to that subset. 

Remark 2: Note that we could use a "padded version" of subm as a commu- 
nication task whose membership in Q^^ follows from Proposition [71 but not 
from Fact However, the example of / is probably more interesting, since 
for its efficient solution shared randomness is necessary (while for solving 
subm shared randomness is not required). 

Remark 3: There exists another qualitative difference between our Propo- 
sition [7| and Yao's Fact El while the latter easily extends to the case of 
relational problems f |GKWO^ ). the bound obtained in Proposition [71 seems 
to be "inherently functional" (even boolean, in some sense). 

5.2 Separating qI from qI and rI from i?| 

In this section we "almost show" that rI ^ qI (and therefore C qI). 
We demonstrate a relation which can be solved exactly in i?e(and therefore 
in QI), but cannot be efficiently solved in in the following setting: the 
referee may not make a mistake, however he is allowed to announce don't know 
with some constant probability (less than 1). Of course, this requirement 
(we call it "don't know" setting) is less severe than exact solvability, and 
therefore our result may be viewed as exponential separation between the 
model of quantum communication with shared entanglement and the model 
of quantum communication with shared randomness. 
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On the other hand, we conjecture that our relation is hard for the "stan- 
dard" qI (which we address as bounded- error setting), but we could not prove 
that. However, there is a known lower bound for the bounded-error setting 
for the model (and therefore for given in |BJK04j for a communica- 
tion problem which is actually a simplified (and easier for communication) 
version of the relation we will define here. So, we conclude that i?| C rI and 
even that rI ^ R^ in the standard bounded-error setting.^ 

Generalizing a construction used in |BJK04j . we define a family of re- 
lations parametrized by {n e N | n is even}. Denote by M„ the set of all 
perfect matchings over n elements (labeled as {1, ...,n}). 

Definition 12. Let a G {0,1}" and m e M„. For any x = {a^^\m) and 
y = a^^^ such that a^^^ © a^^^ = a (where © means bit-wise xor), 

MHMn{x,y) = {(z,j,6) | a^®aj = b, (z,j) em}. 

In order to show that MHMn is efficiently exactly solvable in i?l we adapt 
a clever protocol suggested by Buhrman ^ (see also |BBT04j ). 

5.2.1 MHMn Is Exactly Solvable in rI 

Consider the following i?|-protocol for MHMn- 

• Before the communication starts, Alice and Bob share [logn] pairs of 
entangled qubits: X]ie[n] N) N) • 

• When Alice receives x = (a^^^^ , m) she applies the following transfor- 
mation to her part of the entangled pairs: 

iz)^(-ir-'"' 

Similarly, Bob flips the sign of those parts of the entangled ^ |^) \i) 
which correspond to a- =1. 

• Alice performs partial projection of her part of entangled qubits to 
the subspaces of dimension 2 spanned by all pairs of indices in the 
matching m (fulfilled if necessary by "insignificant" subspace of the 

•^The last observation is actually not a contribution of this paper but rather a compi- 
lation of lower and upper bounds from jBJK04j and , correspondingly. 
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indices greater than n, less or equal to 21^^°^"^). After the measurement, 
the common state of shared entangled pairs becomes 

-^{\k)\k)±\l)\l)), 

where {k, I) G m. Moreover, the amplitudes of |A;) |A;) and |/) |/) coincide 
if and only if ak = ai. 

• Both Alice and Bob perform [logn]-qubit Hadamard transform on 
their parts of entangled qubits and then measure in the standard basis. 
As a result, Alice obtains bi and Bob obtains 62, such that 

{h © ^2) ■ (A; © /) = flfc © ai, (1) 

where © denotes bit- wise xor operation and • stands for the inner prod- 
uct mod 2 of two vectors. Alice sends (fc, /, bi) and Bob sends 62 to the 
referee. 

• According to (H)), the referee computes © a/ and outputs the triple 
(/c, /, © ai), as required. 

The protocol and the analysis are very similar to those in |BJK04j . The 
probability that the referee produces {k, /, b) is 



i=((A:| + (-l)^(/|)|^) 



which equals 2/nii {k,l,b) G MHMn{x,y) and otherwise. The protocol is 
always correct. 

The fact that MHMn G rI (which is strengthening of the more obvious 
MHMn G <5l) is due to 0- 



5.2.2 MHMn ^ Qp for the "Don't Know" Setting 

Let us slightly simplify the task and assume that the matching m in the 
input to MHMn always comes from a fixed family of n/2 edge-disjoint 
matchings on n elements (as before, n is even). Now we use Fact 0] to "get 
rid" of the shared randomness. We choose the input distribution Di to be 
uniform: a(^), a(^) G {0, 1}" , m G M^. 
We will prove the following. 
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Claim 13. The communication cost of computing MHMn in the model Q^^ 
in the "don't know" setting is (ri^/^), when the input distribution is Di. 

The claim leads to the following theorem. 

Theorem 14. The communication cost of computing MHMn in the model 
Qp in the "don't know" setting is (ra^/^) . 

To prove the claim, we generalize a technique from |GKW04' . 

Proof of Claim (73! Consider a protocol T solving the problem in the "don't 
know" setting with success probability at least 7/8, let s be its communica- 
tion cost (note that in the "don't know" setting the success probability can 
be amplified using parallel repetition). 

We know that |M^| = n/2, denote by Mi the subset of those m G 
satisfying Ptd^ [T fails|m] < 1/4, where the conditioning is on the fact that 
m is the matching given to Alice. It must hold that 

\Mi\ > n/A. 

We want to claim that for some matching m G Mi the referee outputs 
every pair from m with rather low probability, unless s is big. 

Let us forget for a moment about the cost of communication between 
Alice and the referee, and assume that Alice forwards her complete input 
to the referee (this setup corresponds to the 1-way communication model). 
Then the referee can output a pair {i,j) G m if and only if he knows the 
value of © a^^^ . 

Consider the mixed state corresponding to the uniform distribution of 
a*-^^ (as imposed by Di), and let /3x be the density matrix of the message 
sent by Bob to the referee when a^^^ = x. Then the whole message sent to 
the referee is 

X 

Let us denote by p{i, m) the probability that the referee outputs the pair 
{i,j) G m when he receives /? from Bob and the required matching is m G Mi. 
Let 

Am = maxp(z, m) 

i 

be the highest probability for outputting any specific pair when the required 
matching is m. Denote Aq = min^ A^- For each m G Mi let im be any fixed 
index satisfying p{im,m) > Aq and jm be such that {im,jm) ^ 
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Suppose now that Bob sends I/Aq independent copies of his message, 

( Fi^ ( Fi) 

then the referee is able to learn the value of a) (B a) with probability 
at least 1/2. In other words, by sending s/Aq qubits Bob lets the ref- 
eree learn any |a-^^'' © a^^2 I ^ | with probability at least 1/2 (since 
Bob does not know m, his message must be good for any m G Mi). Let 
E = {{im,jm) I "2 G Ml } and V be the set of endpoints of E. The size of E 
is at least n/4 (since we have required that Mi consists of disjoint match- 
ings) and \V\ > y/n/2. Let V^' C be a subset of size < |V^|/2, such that 
every point in ^ \ y has at least one neighbor in V (the neighborhood is 
defined hj E). 

Let us further strengthen the referee and let him know the values of 
all ^a^^^ I i G V^'|. Then by choosing one of m G Mi and trying to learn 

the corresponding value ofa\^ © QjJ using the original protocol, the ref- 
eree is able to get (with certainty) the value of any |a,-'^'' | z G V \y | 

with probability at least 1/2, using the message of length s/Xq. If instead 
of announcing "don't know" the referee would make a random guess of 
the value of a] , his total correctness probability would increase to 3/4. 
Since \V \ V'\ > \V\/2 > ^Jnj^:^ by applying Nayak's bound on the length 
of a random access codes ([N99j) we obtain the following relation: s/Aq > 
(1 - //(3/4)) ■ y^/4, or 

22s 

Ao < 

Fix mo to be some matching from Mi satisfying maXjp(i,mo) < 

Now let us return to the simultaneous message model. Denote by D2 
the following input distribution: Alice receives (a*-'^'',mo) and Bob receives 
a^-^), where a^^^ and a^^-* are uniformly and independently distributed over 
{0, 1}". As follows from the definition of Mi, the protocol T solves MHMn 
over D2 with success probability at least 3/4, and every individual pair from 
mo is returned by T with probability not higher than 

def 22s 

'n 



Fix an indexing for the edges of the matching we've chosen: mo = 
{cfc I 1 < A; < n/2} . For the rest of the proof we will use the following nota- 
tion: 

JA) _AA) (A) (B) _ (B) (B) 
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where 1 < k < n/2 and = {ikijk)- In these terms, given an input from the 
support of the distribution if the protocol is successful it should produce 
\ together with = {ik,jk)- If the input is distributed according 
to D2 then the protocol succeeds with probability at least 3/4 and each is 
returned with probability at most po. 

The latter statement can be reformulated in a stronger form: the infor- 
mation received by the referee does not allow it to learn with 0-error any of 
Ck with probability higher than po (this is true since from the beginning we 
might restrict attention to the protocols which always try to "boost" one of 
the edges). Let q^^^ denote the success probability of the referee in guess- 
ing x\f^ in the "don't know" setting, when a^^'^ is uniformly chosen. Then 
according to the Holevo bound, 

l<fc<n/2 

Similarly define q^ , then 

l<fc<n/2 

Now we need the following lemma, which is a simple modification of 
Lemma 1 from |GKW04] (a proof can be found in the appendix section). 

Lemma 15. Consider two quantum registers, the first containing either ao 
or a\ and the second containing either /3o or (5i ( each register contains either 
one of the corresponding mixed states with probability 1/2 and the registers 
are not correlated in any way). Denote by a the maximum success probability 
of distinguishing ao and a\ in the "don't know" setting, define b similarly 
for (3o and f3i. Let p be the maximum success probability for a measurements 
with 3 outcomes: [ao ® Po or ai ® (3i], [ao ® Pi or a\ ® P^ and [don't know] 
(where "successful" are the first two outcomes). Then p < iab. 

According to the lemma, the probability of the protocol to be successful 
is upper bounded by 

l<fc<n/2 

subject to ([21), (jSl), and q\f^q]^^ < Po for all 1 < k < n/2 (which follows 
from the obvious lower bound ab on the success probability in simultane- 
ous 0-error guessing of the content of the both registers in the condition of 
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Lemma IT^ . The maximum is achieved if we pick a set K of size s / ^/pq and 
fix q"ff^ = qlf^ = y/po for every k & K. This gives the following upper bound 
on the success probability: 

s ( s^/'^ \ 

and its value must be at least 3/4. This leads to s G (n^/^) . UciaimTm 

6 Open Problems 

• We know that = C Ql = R^. Are they equal? 

• We were only able to demonstrate that MHMn ^ QI for "don't know" 
setting, while we conjecture that the problem is hard for qI in the 
standard (bounded-error) setting as well. 

• We have shown our separation using a relation. Can similar results be 
obtained for a (partial) boolean function? What about a total function? 
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A Appendix 



A.l Proof of Lemma 1151 

Lemma I15L Consider two quantum registers, the first containing either ao 
or ai and the second containing either (3q or (3i ( each register contains either 
one of the corresponding mixed states with probability 1/2 and the registers 
are not correlated in any way). Denote by a the maximum success probability 
of distinguishing and ai in the "don't know" setting, define b similarly 
for (3q and (3i. Let p be the maximum success probability for a measurements 
with 3 outcomes: [ao ® Po or ai ® Pi], [ao <^ Pi or ai ® Po] and [don't know] 
(where "successful" are the first two outcomes). Then p < Aab. 

Proof of Lemma[T^ In order to prove the lemma it suffice to slightly modify 
the proof of similar Lemma 1 in |GKW04j . 

Let us define several subspaces of our quantum registers. Call Sq the 
support of tto (i-e., the span of its non-zero eigenvectors), and let 5*1 be the 
support of tti. Similarly define Tq and Ti for Pq and Pi. 

According to 0-error requirement of our lemma, the positive semidefinite 
operator corresponding to the measurement outcome [ao ® Po or ai ® Pi] 

should have all its eigenvectors lying inside R =^ {Si x To)"*" fl {Sq x Ti)-*-. 
Expanding, we get R = {S^ x T^) © {Sq x T^*-) (where © denotes direct sum 
of vector spaces), so that the probability to observe this outcome is at most 
the probability to project the measured state to either x or Sq x T^. 

Similarly, the probability to obtain the outcome [ao ® Pi or ai ® Po] is at 
most the probability to project the state to either x or Sq x T^. 

Let Po be the maximum among the probabilities to project the content of 
our two registers to S^- x Tj-, where i, j G {0, 1} , and w.l.g., let the maximum 
be obtained for i = j = 0. Observe that in this case po is just the probability 
to project the first register to Sq times the probability to project the second 
register to T^. The former is equal to the probability to declare with certainty 
that "the ffist register contains ai" and the latter is equal to the probability 
to declare "the second register contains Pi" , with certainty too. By definition, 
this is bounded above by ab, and therefore p < 4po < 4a6. ^Lemma\T^ 
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